Linux Kernel EUVD-2026-35431

Requires local code execution on the target host with a valid unprivileged user session (CVSS PR:L), and the SMC subsystem must be present - specifically a kernel built with CONFIG_SMC where the smc module is loaded or auto-loadable, allowing setsockopt(TCP_ULP, "smc") on an open TCP socket to succeed. Affected kernels are 5.17 through pre-6.19.4 / pre-7.0; kernels older than 5.17 (before commit d7cd421da9da) and patched 6.19.4/7.0 builds are not affected. Limiting factors: SMC is not loaded by default on most general-purpose distributions and is primarily used on IBM Z (s390x) and RoCE/RDMA deployments, no network-reachable trigger exists (AV:L), and successful UAF-to-privesc weaponization requires kernel heap grooming against a race window rather than a one-shot bug.

Signals are consistent with a serious-but-narrow kernel bug rather than a fleet-wide emergency. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 and correctly reflects that an attacker must already have a local foothold with at least an unprivileged account to reach the SMC ULP attach path. EPSS of 0.02% (5th percentile) and absence from CISA KEV indicate no observed exploitation, and the bug was caught via code review by Al Viro rather than incident response. There is no public exploit identified at time of analysis. The defect is described as a design flaw causing instability/UAF, which can plausibly be steered toward local privilege escalation, but weaponization would require kernel heap shaping against a rarely-enabled subsystem (CONFIG_SMC) - SMC is not loaded by default on most distributions. Prioritize patching multi-tenant hosts and any system that loads the smc module; for systems without SMC enabled, the practical risk is effectively zero.

A local user with shell access on a multi-tenant Linux host where the smc kernel module is loaded opens a TCP socket and invokes setsockopt(SOL_TCP, TCP_ULP, "smc"), causing the kernel to swap out the struct file/dentry/inode underneath the active fd; by racing concurrent /proc/self/fd or close()/dup() operations against the conversion, the attacker triggers a use-after-free on freed VFS objects and corrupts kernel heap state to escalate to root. No public proof-of-concept has been published, but the bug class (UAF in core VFS objects with low complexity local trigger) is well-trodden territory for kernel exploitation researchers.